What Mental Health Practices Need to Know About HIPAA-Compliant Virtual Assistants

A HIPAA-compliant virtual assistant is a remote administrative worker who handles protected health information under the rules HIPAA sets for business associates. In practice, that means the company signs a Business Associate Agreement with your practice before any access to client information, the assistant is trained in HIPAA, their work setup has administrative, physical, and technical safeguards in place, and they can only reach the information their tasks require. There's no government certification that makes a virtual assistant "HIPAA certified." Compliance comes from the agreement, the safeguards, and how the work is actually done.

For mental health practices, the stakes feel higher, and they should. The information our clients share is deeply personal. Bringing anyone new into the workflow, in the office or remote, deserves a careful look. This guide covers what HIPAA requires when you work with a virtual assistant, where mental health practices need extra care, and the questions worth asking before anyone logs in.

This article is general information, not legal advice. Talk with your compliance advisor or healthcare attorney about your specific situation.

Why HIPAA comes up the moment you consider a virtual assistant

The minute a virtual assistant answers your phones or opens your EHR, they'll see protected health information. That includes client names, appointment times, insurance details, and sometimes the reason someone is reaching out. Under HIPAA, an outside company that handles that information on your behalf is usually a business associate.

According to the U.S. Department of Health and Human Services, a business associate is generally a person or organization that performs functions or activities on behalf of a covered entity involving the creation, receipt, maintenance, or transmission of protected health information (HHS Business Associates guidance). A virtual assistant company scheduling your clients and verifying their insurance fits that description.

In my own practice, I try to treat every new vendor as a privacy question first and a convenience second. Asking where the data goes is one of the first questions on my list.

What a Business Associate Agreement is and what it must cover

A Business Associate Agreement, or BAA, is the contract that spells out how a business associate will protect your clients' information. HHS says the agreement must describe the permitted and required uses and disclosures of protected health information, make sure the business associate won't use or disclose it beyond what the agreement allows or the law requires, and require the business associate to meet the Privacy Rule obligations for any work it does on your behalf (HHS).

HHS also makes clear that business associates are directly liable for complying with certain parts of the HIPAA Rules. That's important. A good virtual assistant company should take its own compliance seriously, not just point back to you.

When you review a BAA from a virtual assistant company, look for these basics.

1. Permitted uses. What the company and its assistants may do with client information, tied to the services you're buying.
2. Safeguards. A commitment to protect electronic health information under the HIPAA Security Rule.
3. Subcontractors. A requirement that anyone they bring in agrees to the same restrictions.
4. Breach reporting. How and how quickly they'll tell you if something goes wrong.
5. Access and amendment. How they'll help you respond if a client asks to see or correct their records.
6. Termination. What happens to your clients' information when the relationship ends.

The rule of thumb is simple. No BAA, no access. If a company hesitates to sign one, that tells you what you need to know.

The safeguards that make a virtual assistant setup compliant

A signed agreement is the start. The HIPAA Security Rule requires three kinds of safeguards for electronic protected health information (HHS Security Rule). Here's what each one looks like when your front desk is virtual.

Administrative safeguards

These are the policies and people side of security. HHS lists examples like risk assessments, a designated security official, workforce security policies, security training, and incident response procedures. For a virtual assistant, that means documented HIPAA training before day one, regular recertification, clear policies on what they can and can't do, and a known process for reporting a mistake.

Physical safeguards

These protect the actual devices and spaces where information is handled. For a remote assistant, ask whether they work from a private space, whether screens are visible to anyone else, and whether client information is ever printed or stored on a personal device. A secure virtual desktop, where the work happens on a protected remote system rather than the assistant's own computer, is one common way to handle this.

Technical safeguards

These are the technology controls. HHS points to access controls, audit logs, integrity checks, user authentication, and encryption for information in transit. In everyday terms, your assistant should have their own login to every system (never a shared password), use multifactor authentication, and work in systems that keep a record of who accessed what.

Minimum necessary access, and why psychotherapy notes need extra care

HIPAA's minimum necessary standard means people should only have access to the information their role requires. HHS notes that the Security Rule applies this principle when deciding who can access electronic health information (HHS Security Rule).

For a virtual assistant, that usually looks like this.

• Scheduling tasks need the calendar, contact details, and appointment types
• Insurance verification needs insurance cards, demographics, and access to payer portals
• Billing follow-up needs balances and payment history
• None of these tasks need clinical documentation

Mental health practices have one more layer to think about. HHS defines psychotherapy notes as notes recorded by a mental health professional documenting or analyzing the contents of a conversation during a private counseling session, kept separate from the rest of the medical record. HHS says they receive special protection, and covered entities generally must get a client's authorization before disclosing them for almost any reason (HHS FAQ on mental health information).

Your administrative team has no reason to see psychotherapy notes. Check your EHR's permission settings before your assistant's first day, and make sure their role can't open clinical notes at all. Many EHRs let you create a front desk or biller role with limited access. If yours doesn't, that's worth raising with your EHR vendor.

If your practice treats substance use disorders, ask your compliance advisor whether federal rules beyond HIPAA apply to your records. Some substance use treatment programs follow additional confidentiality regulations, and your assistant's access should reflect that.

Offshore virtual assistants and HIPAA

This question comes up a lot, so here's a straight answer. HIPAA does not ban protected health information from being accessed outside the United States. What it requires is a compliant BAA, appropriate safeguards, and minimum necessary access, wherever the work happens (Shumaker, Loop and Kendrick, December 2025).

Other rules can still apply, though.

• Some payer contracts restrict offshore access. Medicare Advantage plans require detailed attestations about offshore subcontractors that handle beneficiary information, and those duties can flow down to network providers.
• Some state Medicaid contracts go further. The same analysis notes that the Texas Medicaid managed care contract prohibits work performed outside the United States and bars offshore access to state health data.
• Enforcement is harder across borders. If something goes wrong, your practice may carry more of the cleanup.

If your practice bills Medicaid managed care or Medicare Advantage, review those contracts before you give any offshore assistant access to those clients' information. At Front Desk Friday, we talk this through on every fit call so practices can decide which tasks make sense.

Red flags when choosing a virtual assistant company

A few warning signs are worth walking away from.

• They won't sign a BAA, or they want you to sign theirs without reading it
• They describe their assistants as "HIPAA certified" but can't explain the training or safeguards behind it
• Assistants work on personal laptops with client information saved locally
• They ask for your login instead of creating a separate account for the assistant
• There's no plan for what happens if an assistant makes a privacy mistake
• They can't tell you where their assistants are located

Questions to ask before anyone logs in

Bring this list to any conversation with a virtual assistant company, ours included.

1. Will you sign a Business Associate Agreement before my assistant has any access?
2. What HIPAA training do assistants complete, and how often do they recertify?
3. Do assistants receive training specific to mental health practices?
4. What device and network do assistants work from, and is client information ever stored locally?
5. Will each assistant have their own login with multifactor authentication?
6. How do you handle a suspected privacy incident, and how fast will you tell me?
7. Where are your assistants located, and how does that interact with my payer contracts?
8. What happens to my clients' information if we stop working together?

What to set up inside your own practice

Even with a strong partner, some pieces live on your side.

1. Update your risk assessment to include the new workflow.
2. Create a limited role in your EHR that blocks clinical notes.
3. Give the assistant their own accounts for every system, and turn off access promptly when the relationship ends.
4. Write your crisis handoff plan so administrative staff never make clinical calls.
5. Keep your BAAs organized in one place with renewal dates.
6. Review access every few months. Tasks change, and permissions should change with them.

The bottom line

A HIPAA-compliant virtual assistant isn't about a badge. It's about a signed agreement, real safeguards, limited access, and a team that takes your clients' privacy as seriously as you do. Mental health practices have good reason to ask hard questions, and any company worth working with should welcome them.

If you'd like to see how we handle this at Front Desk Friday, our How It Works page walks through our privacy setup, and you can book a fit call to ask us anything on this list. For a broader look at what an assistant can take off your plate, read our guide to virtual assistants for therapists.

Frequently asked questions

Can a virtual assistant be HIPAA compliant?

Yes. A virtual assistant can work in a HIPAA-compliant way when their company signs a Business Associate Agreement with your practice, they're trained in HIPAA, they work from a secure setup, and they only access the information their tasks require.

Do I need a BAA with a virtual assistant company?

In most cases, yes. If the company or its assistants will create, receive, maintain, or transmit protected health information for your practice, HHS generally considers them a business associate, and you need a signed BAA before they have access.

Is there such a thing as a HIPAA certification for virtual assistants?

There's no official government HIPAA certification. Training programs issue certificates, which show the assistant completed training, but compliance depends on the BAA, safeguards, and daily practices.

Can offshore virtual assistants access patient information under HIPAA?

HIPAA doesn't ban offshore access, but it still requires a BAA and proper safeguards. Some Medicare Advantage and state Medicaid contracts restrict offshore access, so check your payer contracts first.

Should my virtual assistant be able to see therapy notes?

No. Administrative tasks don't require clinical documentation, and psychotherapy notes have special protections under HIPAA. Set up a limited EHR role that blocks access to clinical notes.